Terry P Moosmann CPA PC Data Breach

Terry P Moosmann CPA PC, a financial services company operating within the United States, has been publicly listed as a victim on the dark web portal of the ransomware group known as The Gentlemen. This listing, identified by SOCRadar’s Dark Web Monitoring service, was published on July 16, 2026. The organization’s placement within The Gentlemen’s recent activity suggests a pattern of targeting across various sectors and geographic locations. The financial services industry, often handling sensitive data, can be an attractive target for ransomware operations seeking financial gain through data exfiltration and extortion. In the 60 days leading up to this specific listing, The Gentlemen group claimed a total of 132 other victims. The group has demonstrated a consistent focus on the Business Services, Manufacturing, and Healthcare sectors, with a significant concentration of victims located in the United States, Germany, and France. Terry P Moosmann CPA PC aligns with this targeting pattern, being a US-based entity within the Financial Services sector. Other organizations recently listed by The Gentlemen that share a similar profile include Hanseata, Arabia Falcon Insurance Company SAOG, Customs Watch, and Dash Door Glass.

SOCRadar’s analysis of stealer-log telemetry related to the domain terrymoosmanncpa.com returned no records within the queried dataset. It is crucial to understand that a null result does not definitively confirm that the organization is unaffected by compromise. The query encompasses a partial and paginated sample of data. Exposure may exist through alternate corporate domains, personal email aliases, or logs that were harvested by infostealers and subsequently rotated before being indexed by the monitoring service. The absence of credentials in this particular search is not conclusive evidence of a clean system. For ransomware threat actors like The Gentlemen, credentials harvested by infostealers represent a well-established vector for initial access. Threat actors or initial access brokers typically source these credentials from underground marketplaces. They then validate the legitimacy of these corporate accounts and use them to gain unauthorized access to systems, often via Microsoft 365, VPNs, or other remote access portals, before deploying ransomware. The lack of identified credentials in this query does not preclude this attack scenario, as data may have appeared in sources not covered by this specific search, or credentials may have been rotated post-harvesting and pre-indexing. Given these observations, CTI teams should prioritize ongoing monitoring of the dark web and stealer-log feeds. Proactive measures such as credential hygiene checks, password rotation, and multi-factor authentication reviews remain essential. Monitoring for activity across alternate corporate domains and reviewing access logs for Microsoft 365, VPNs, and remote-access solutions are also recommended steps to mitigate potential risks.

Disclaimer

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.